---
title: "Critical Hex (Erlang/Elixir) advisories"
url: https://erroneo.us/security/ecosystem/hex/
description: "All 6 critical GitHub-reviewed Hex (Erlang/Elixir) security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-08-25
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Hex (Erlang/Elixir) advisories

- 2026-08-25 [CVE-2026-48853](https://erroneo.us/security/cve/CVE-2026-48853/index.md) gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads — grpc >= 0.4.0, < 1.0.0 → 1.0.0
- 2026-08-25 [CVE-2026-49757](https://erroneo.us/security/cve/CVE-2026-49757/index.md) AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching — ash_authentication >= 0.1.0, < 4.14.0 → 4.14.0; ash_authentication >= 5.0.0-rc.0, < 5.0.0-rc.10 → 5.0.0-rc.10
- 2026-07-01 [CVE-2026-49457](https://erroneo.us/security/cve/CVE-2026-49457/index.md) QUIC has Broken TLS verification — quic <= 1.4.3 → 1.4.4
- 2026-06-26 [CVE-2026-49454](https://erroneo.us/security/cve/CVE-2026-49454/index.md) Relyra SAML SignatureValue not cryptographically verified -> authentication bypass — relyra >= 1.0.0, < 1.2.0 → 1.2.0
- 2026-06-09 [CVE-2026-8467](https://erroneo.us/security/cve/CVE-2026-8467/index.md) PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground — phoenix_storybook >= 0.5.0, < 1.1.0 → 1.1.0
- 2024-02-10 [CVE-2024-25718](https://erroneo.us/security/cve/CVE-2024-25718/index.md) Samly access control vulnerability — Samly < 1.4.0 → 1.4.0

---
Source page: https://erroneo.us/security/ecosystem/hex/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt